Network-based protection against scam applications

A system, comprising:

• one or more processors;
• and
• memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising:
• monitoring outgoing communications from a user device following a notification that an application is installed on a user device, the outgoing communications including at least one of one or more voice calls or one or more messages to an emergency services number;
• determining that a number of the outgoing communications to the emergency services number during a predetermined period of time exceeded a corresponding quantity threshold;
• ascertaining, via a pattern matching algorithm or a machine-learning algorithm, that a pattern of the outgoing communications for which the number exceed the corresponding quantity threshold during the predetermined period of time is an anomalous pattern;
• directing the user device to present a prompt that requests an input at the user device as to whether the outgoing communications are authorized as a result of the pattern fitting the anomalous pattern;
• in response to a first input from the user device indicating that the outgoing communications to the emergency services number are not authorized, directing the user device to present a recommendation to remove the application from the user device, and storing the first input as a corresponding vote that the application is malicious;
• and
• in response to a second input from the user device indicating that the outgoing communications to the emergency services number are authorized, storing the second input as a corresponding vote that the application is non-malicious.

A computer-implemented method, comprising:

• monitoring, via one or more computing nodes, outgoing communications from a user device following a notification that an application is installed on a user device, the outgoing communications including at least one of one or more voice calls or one or more messages to a premium-rate number;
• determining, via the one or more computing nodes, that a number of the outgoing communications to the premium-rate number during a predetermined period of time exceeded a corresponding quantity threshold;
• ascertaining, via a pattern matching algorithm or a machine-learning algorithm that is executed by the one or more computing nodes, that a pattern of the outgoing communications for which the number exceed the corresponding quantity threshold during the predetermined period of time is an anomalous pattern;
• directing, via the one or more computing nodes, the user device to present a prompt that requests an input at the user device as to whether the outgoing communications are authorized as a result of the pattern fitting the anomalous pattern;
• in response to a first input from the user device indicating that the outgoing communications to the premium-rate number are unauthorized, blocking, via the one or more computing nodes, additional outgoing communications from the user device to the premium-rate number for a predesignated amount of time, and storing the first input as a corresponding vote that the application is malicious;
• and
• in response to a second input from the user device indicating that the outgoing communications to the premium-rate number are authorized, storing, via the one or more computing nodes, the second input as a corresponding vote that the application is non-malicious.